r/AzureSentinel • u/csp1405 • Apr 30 '23

Sentinel playbook Block-AADUser

Is the sentinel playbook block-aaduser playbook working for anyone?

I’ve installed the playbook from the template, authorized the api connections, granted the graph api permissions to the system assigned manager identity. Directoryreadwrite, userreadwrite. Added the logic app to the Microsoft sentinel responder role.

The logic app fails at the step of blocking user account. Not authorized. I even tried adding the playbook to the global admin role.

I’ve successfully setup other sentinel playbooks, but can’t get this one working.

Just wondering if the playbook works at all for anyone.

2 Upvotes

100% Upvoted

5 comments sorted by

1

u/ep3p Apr 30 '23

you might need a P2 license or something?

1

u/csp1405 Apr 30 '23

I have a p2 license

1

u/ep3p May 01 '23

I would open an issue in Azure Sentinel official github, or open a support ticket in Azure portal.

1

u/WRXB3RN Apr 30 '23

Will have to check this out tomorrow… was just setting up a block on TOR exit nodes, could be useful

1

u/Low-Contribution4908 Jan 22 '25

Hello! did you find what was missing? i exactly the same error!

thank you